music-mirror

5 Commits 3 Branches 8 Tags

2 Commits

Author	SHA1	Message	Date
Emma Thorpe	18b1bbbbd1	fix: make everything written into the mirror group-readable The mirror is written by one account and read by another -- an SMB share, or whatever else serves it -- but nothing here produced a group-readable file. Encodes go through `tempfile.mkstemp`, which creates 0600 regardless of the umask and keeps that mode through the rename into place, so every encoded track landed unreadable. Copies of existing MP3s inherit the mode of a source file in a library this tool does not own, which may be no better. Add the group-read bit explicitly: to the temporary file before it is renamed, so a mirror file is never visible without it, and to a copy once it has landed. Directories are handled by clearing the group bits from the process umask rather than chmod'ing each one, since a file the group cannot reach is no more useful than one it cannot read. Only the group bits are touched; the world bits and ownership stay with the umask as before. Mirror files written before this are repaired on the next pass. Their mtimes are correct, so no other part of the pass would revisit them, and topping up the mode costs a stat rather than a re-encode.	2026-08-24 11:26:13 +01:00
Emma ThorpeandClaude Opus 5	6f840c2d55	fix: use the registry secret that exists, and allow manual releases Build and publish container / build (pull_request) Successful in 4m16s Details The login step referenced PACKAGES_SECRET while the secret configured on this repository -- and on its sibling -- is PACKAGES_TOKEN. The expression resolved to an empty string and docker/login-action failed with "Password required", so the first release published nothing and created no tag. The push trigger only fires on image-affecting paths, which a workflow-only change is not, so merging this fix alone would not produce a release. workflow_dispatch can now cut one, restricted to main so a manual run on another branch cannot tag a commit that is not on the default branch. Verified by running the version step across every event and ref combination: push and workflow_dispatch on main release, everything else does not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 15:47:05 +01:00

Author

SHA1

Message

Date

Emma Thorpe

18b1bbbbd1

fix: make everything written into the mirror group-readable

The mirror is written by one account and read by another -- an SMB share, or
whatever else serves it -- but nothing here produced a group-readable file.
Encodes go through `tempfile.mkstemp`, which creates 0600 regardless of the
umask and keeps that mode through the rename into place, so every encoded
track landed unreadable. Copies of existing MP3s inherit the mode of a source
file in a library this tool does not own, which may be no better.

Add the group-read bit explicitly: to the temporary file before it is renamed,
so a mirror file is never visible without it, and to a copy once it has landed.
Directories are handled by clearing the group bits from the process umask
rather than chmod'ing each one, since a file the group cannot reach is no more
useful than one it cannot read. Only the group bits are touched; the world bits
and ownership stay with the umask as before.

Mirror files written before this are repaired on the next pass. Their mtimes
are correct, so no other part of the pass would revisit them, and topping up
the mode costs a stat rather than a re-encode.

2026-08-24 11:26:13 +01:00

Emma ThorpeandClaude Opus 5

6f840c2d55

fix: use the registry secret that exists, and allow manual releases

Build and publish container / build (pull_request) Successful in 4m16s

Details

The login step referenced PACKAGES_SECRET while the secret configured on this
repository -- and on its sibling -- is PACKAGES_TOKEN. The expression resolved
to an empty string and docker/login-action failed with "Password required",
so the first release published nothing and created no tag.

The push trigger only fires on image-affecting paths, which a workflow-only
change is not, so merging this fix alone would not produce a release.
workflow_dispatch can now cut one, restricted to main so a manual run on
another branch cannot tag a commit that is not on the default branch.

Verified by running the version step across every event and ref combination:
push and workflow_dispatch on main release, everything else does not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-21 15:47:05 +01:00